Description
GoCD是ThoughtWorks公司推出的开源持续交付/持续集成（CD/CI）平台，是企业级DevOps工具的首选平台。该产品采用Java开发，提供可视化流水线、版本控制集成、自动化部署、环境管理等功能，广泛应用于软件开发、测试、运维等DevOps场景。GoCD /go/add-on/business-continuity/api/cruise_config 接口存在信息泄露漏洞，攻击者可通过该接口获取系统敏感配置信息，包括API密钥、Webhook密钥等。
GoCD Cruise /go/add-on/business-continuity/api/cruise_config 信息泄露漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://attackerkb.com/topics/ShpnUFlqDz/pre-auth-takeover-of-build-pipelines-in-gocd-cve-2021-43287
https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover
https://censys.com/blog/gocd-unauthenticated-takeover
https://nvd.nist.gov/vuln/detail/CVE-2021-43287
https://pulsesecurity.co.nz/advisories/GOCD-Multiple-Vulnerabilities